This discussion has been locked. The information referenced herein may be inaccurate due to age, software updates, or external references.
You can no longer post new replies to this discussion. If you have a similar question you can start a new discussion in this forum.

Unable to alert on interface in "monitoring" ie: span port mode.

I have a critical interface, which is administratively up, and operationally down (normal state for span port monitoring). I need to create an alert to trap if the output rate (bits/sec) drops below a certain threshold.

Here is sample of the interface to demonstrate that despite line protocol (operationally) down - interface is outputting traffic. I have tried to put interface in "unpluggable" mode. Still no luck.

 

VH-TDC-B13-6509-1#show int gi8/48
GigabitEthernet8/48 is up, line protocol is down (monitoring)
  Hardware is C6k 1000Mb 802.3, address is 0015.6305.22e7 (bia 0015.6305.22e7)
  Description: MCAFEE_SPAN_PORT
  MTU 1500 bytes, BW 1000000 Kbit, DLY 10 usec,
     reliability 255/255, txload 38/255, rxload 1/255
  Encapsulation ARPA, loopback not set
  Keepalive set (10 sec)
  Full-duplex, 1000Mb/s
  input flow-control is off, output flow-control is on
  Clock mode is auto
  ARP type: ARPA, ARP Timeout 04:00:00
  Last input never, output 1w5d, output hang never
  Last clearing of "show interface" counters 1w5d
  Input queue: 0/2000/0/0 (size/max/drops/flushes); Total output drops: 378408317
  Queueing strategy: fifo
  Output queue: 0/40 (size/max)
  5 minute input rate 0 bits/sec, 0 packets/sec
  5 minute output rate 150032000 bits/sec, 29277 packets/sec
     0 packets input, 0 bytes, 0 no buffer
     Received 0 broadcasts (0 multicasts)
     0 runts, 0 giants, 0 throttles
     0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored
     0 watchdog, 0 multicast, 0 pause input
     0 input packets with dribble condition detected
     38716232497 packets output, 37642764730112 bytes, 0 underruns
     0 output errors, 0 collisions, 0 interface resets
     0 babbles, 0 late collision, 0 deferred
     0 lost carrier, 0 no carrier, 0 PAUSE output
     0 output buffer failures, 0 output buffers swapped out
VH-TDC-B13-6509-1#

  • Hi Ellen--

    Are you familiar with the outstanding paper that Andy McBride wrote on Advanced Alerts:

    It may help you. Also, I'm going to move your post to the Alert Lab forum to see if it will get more traction there.

    M

  • How are you going to setup an alert for traffic if there is no traffic when you look at the solarwinds page for the monitor port.  I am having this same issue, it show up down but no traffic!!!!

  • lancen, you should be seeing traffic on the interface if it is configured properly, and you are on the latest version of NPM.  May want to double check.

  • FormerMember
    0 FormerMember in reply to sschoenh

    I don't see any on my span ports in latest version.  NPM reports span interfaces as down for me.

  • I know this is an old post, but I can confirm that my environment (NPM 12.2) IS collecting traffic statics from the monitoring port (in other words the destination port of a monitor session) on a Cisco switch.   I am also able to mute the alerts for that specific interface to keep it from showing as an active alert.  This at least gives me the ability to graph the bandwidth usage on that port to ensure we are not saturating the port by sending too much span/monitor traffic to it.

    However, the parent node/switch of that interface shows the green status icon with a little red square in the lower right corner, as it believes one of the interfaces is down.    It would be nice if there was a way for NPM to understand that this port is in a "monitoring" status (port is up but line protocol is down) instead of just treating it as if it were down.

  • There is an option to treat a down interface as "unplugged" if you edit the interface properties, though I don't know what the parent node status will show in this case. Might be worth trying.

    pastedImage_0.png